DE102005046462A1 - Network component for a communication network, communication network and method for providing a data connection - Google Patents

Abstract

The invention relates to a network component (11-16) for a communication network (1), in which a plurality of communication interfaces (31-37) are connected for mutual data exchange via a transmission network (20), the network component (11-16) between at least one assigned communication interface (31-37) and the transmission network (20) can be arranged. The network component (11-16) according to the invention has a first storage device (41) for storing at least one predetermined coding key (K1, K2, K3), a decryptor (51) for decrypting encrypted data received via the transmission network (20) using the stored at least one coding key (K1, K2, K3) and a data selector (52) for the optional transmission of data between the transmission network (20) and the at least one assigned communication interface (31-37). The data selector (52) is designed to automatically prevent transmission of encrypted data received via the transmission network (20) to the at least one assigned communication interface (31-37) if the encrypted data is not transmitted by the decryptor (51) using the at least one a coding key (K1, K2, K3) can be decrypted. The present invention further relates to a corresponding communication network and a corresponding method for providing a ...

Description

The The present invention relates to a network component for a communication network which a plurality of communication interfaces to each other Data exchange via a transmission network connected, wherein the network component between at least an associated communication interface and the transmission network can be arranged.

Further the present invention relates to a corresponding communication network, which a data exchange enabling transmission network and a Majority of with the transmission network connected communication interfaces, wherein the communication interfaces for data exchange via the transmission network are formed.

Finally, concerns the present invention provides a method for providing a Data connection between at least two via a transmission network with each other connectable communication interfaces, wherein between at least two the communication interfaces and the transmission network respectively a network component is provided.

such Communication networks can on different transmission networks based. In the simplest case, it is the transmission network about a data connection over a digital communication network such as an ISDN network. In this case, the communication interfaces for example, in each case a modem of a communication subscriber or a server of a network provider.

alternative it may be in the transmission network for example, also a local data network based on Ethernet or a global data network based on Internet Protocol. In In this case, the communication interfaces are for example, one at a time connected to a personal computer Network card.

The however, the present invention is not limited to these examples. Much more can for the purposes of the present invention any data network or any other communication network used as the transmission network which involves the exchange of digital data between at least two communication interfaces and thus at least two communication participants allows.

at such transmission networks individual connections between communication interfaces of Communication participants usually constructed by each communication interface an individual Communication address is assigned. This communication address is either hardware-based in the communication interface given or is from the transmission network allocated dynamically.

In a transmission network with several communication participants there is always the danger that transmitted between the communication participants via the transmission network data intercepted by an unauthorized person or being intercepted. There is also the risk that an unauthorized tried on with those used by the communication participants Communication interfaces and with these possibly connected personal computers, Server or similar access.

to solution One of these problems is known to be data between two communication participants encoded transferred to. Therefor have to the two communication participants, between which the data transmission should take place, first one to be used coding key change. Subsequently have to the data from the sending communication subscriber using of the coding key encoded and over the transmission network be shipped. Received from the receiving communication party Data must be decrypted from this in turn using the coding key.

Under a coding key In this case, data will be understood in the form of bytes, that of a encryption algorithm or a decryption algorithm used to encrypt or decrypt data. Both used coding keys These can be both symmetric and asymmetric coding keys.

This approach has the disadvantage that for the encryption and decryption in each case a manual intervention of a user is necessary. Further is the exchange of the coding key used in practice difficult since this is common also over the transmission network takes place and thus the risk exists that the coding key of an unauthorized person is intercepted or intercepted. Next is for encrypting and Decrypt the Data required a separate software, which is often just awkward too is operating.

In In particular, less savvy users have this in practice considerable difficulty, over a transmission network encrypted Exchange data. Furthermore, the encryption of the data alone does not provide any Protection against an attack over the transmission network, there from the communication interface also unencrypted data be received.

Further it is the solution of the above problems, between communication interfaces the individual communication subscriber and the transmission network respectively to provide a so-called "firewall". The Firewall is a device that uses the communication interfaces against the transmission network isolates and thus access from the outside to the communication interface prevented. For this purpose, the firewall analyzes and checks the transmission network received data before the data to the respective communication interface to get redirected. Furthermore, the firewall is often designed to provide access of a communication subscriber to the transmission network. Identified for this the firewall in received data inter alia a sending communication address a sending communication interface and assesses whether a Data exchange with this communication interface be possible should. An access to classified as unsafe communication interfaces will then automatically blocked by the firewall.

Such a firewall is in the German patent application DE 10340181 described.

adversely On such a firewall is that installing a firewall very expensive. The reason is that the firewall is set up this way is that, on the one hand, a reliable one Data transfer between Communication interfaces of the transmission network is possible and on the other hand ensures sufficient security becomes. Further, using a firewall can not prevent that data transmitted between communication interfaces in the transmission network bugged or being intercepted.

outgoing It is the object of the present invention to provide a network component for a communications network, a communication network and a method of provision a data connection available to provide in a particularly simple and reliable way without user intervention, secure data exchange between at least two over a transmission network enable interconnected communication interfaces.

Further It is the object of the present invention to provide access by an unauthorized person on one with the transmission network complicate connected communication interface over the transmission network.

The The above objects are in a network component for a communication network with the features of the preamble of independent claim 1 by the Characteristics of the characterizing part of independent claim 1 solved.

Further become the above tasks through a communication network with the characteristics of the independent Claim 39 and a method for providing a data connection with the characteristics of the independent Claim 46 solved.

advantageous Further developments can be found in the respective subclaims.

According to one In the first aspect, the present invention relates to a network component for a communications network, in which a plurality of communication interfaces to each other Data exchange via a transmission network connected, wherein the network component between at least an associated communication interface and the transmission network can be arranged is. According to the invention the network component has first storage means for storing at least one predetermined coding key, a decryptor for decipher from above the transmission network received encrypted Data using the stored at least one coding key, as well a data selector for selectively transferring data between the transmission network and the at least one associated communication interface. In this case, the data selector is designed to transmit data via the transmission network received encrypted Data to the at least one associated communication interface to prevent automatically if the encrypted data is not encrypted by the decryptor can be decrypted by means of the at least one coding key are.

By providing the network component according to the invention between a respective associated communication interface and the transmission network is automatically ensured that only such data are forwarded to the communication interface, which can be decrypted by means of egg nes predetermined, stored in the network component encoding key. For this purpose, the network component according to the invention can be formed in the simplest case in order to obtain encrypted data To attempt decryption with all the predetermined encryption keys stored in the first storage means of the network component to determine if the data is decryptable. According to the invention, data transmission can only be achieved if a transmitting communication interface encrypts the data before transmission via the transmission network by means of a coding key which is also stored in the first memory device of the network component which is assigned to the receiving addressed communication interface.

The Decision about between which with the transmission network connected communication interfaces a data exchange is possible, hangs alone from which given coding keys in the first memory device the network component are stored and which coding keys the others with the transmission network connected communication interfaces for encrypting the to be transferred Use data. Because the network component works automatically, it is only necessary to have the network component between the respective associated communication interface and the transmission network to arrange. A configuration by a user is as well other user intervention not required.

According to one preferred embodiment the data selector is formed via the transmission network received encrypted Data after decryption through the decryptor by means of the at least one coding key automatically to the at least forward an assigned communication interface.

there The network component may be a first interface to the connection the network component with the at least one associated communication interface and a second interface for connecting the network component with the transmission network , wherein the first interface with the data selector and the second interface is connected to the decryptor.

Consequently the network component is preferably one with the associated one Communication interface and the transmission network via interfaces solvable connectable device.

This facilitates a flexible structure of the transmission network superimposed Network by providing the network component according to the invention considerably.

Further can the decryptor be trained to over in the transmission network received encrypted Data automatically a key information to identify which one for encryption used coding key features.

In the consequence is it for the decoding of the received encrypted Data not required, all in the first storage device to try stored preset coding key. Much more can be targeted for the decryption the encrypted Data of suitable coding keys be used. Such key information can be found in the received encrypted Data may be included either explicitly or implicitly. For example it is common through analysis of encrypted Data possible, Conclusions on a used encryption method and a used coding key to draw. The key information can the encrypted Data, however, also deliberately attached be an identification of one for encryption used coding key to facilitate.

In In this case, it may be advantageous if the key information a key identifier which is the over the transmission network received encrypted Data unencrypted enclosed is.

In As a result, the identification of the key information is particularly fast, easy and reliable possible.

The Communication interfaces of the transmission network can be used for Addressing in the context of mutual data exchange one each Be assigned communication address. Then the key information from those used to address a respective communication interface Communication address preferably different.

Consequently is the key information from the transmission network used independent and needs a change of the transmission network or a change in the transmission network used communication addresses are not adapted. hereby is the network component according to the invention Can be used flexibly without user intervention.

According to a preferred embodiment, the network component further comprises an encryptor for encrypting data received from the associated communication interface using the stored at least one coding key. In this case, the data selector is designed to receive data received from the assigned communication interface only after encryption by the closures ler by means of at least one coding key automatically output to the transmission network.

Consequently allows the network component according to the invention a bidirectional data exchange of one of the network components associated communication interface with another, via the transmission network connected communication interface, which is also a network component according to the invention assigned. In this case, the respective network component according to the invention represents through the encryption sure that the data sent in the transmission network is not from Listened to an unauthorized person can be. Because the encryption automatically by the encryptor takes place, comes the network component according to the invention without user intervention. The encryptor can continue be formed to be encrypted Data before encryption To add random data, to the used coding key in the encrypted data to disguise.

Then it may also be advantageous if in the first memory device to the at least one predetermined coding key indicative of the coding key key identifier is stored, and the encryptor is formed, encrypted by means of at least one coding key Data after encryption automatically the respective key code the coding key used unencrypted to add.

hereby is it another network component that the encrypted Data over the transmission network receiving, in a particularly simple way, the for the decoding of the encrypted Data required coding key to identify. In the consequence can a decryption the data is particularly fast and easy.

there can the encryptor be further trained to automatically before encryption a control value for the received from the associated communication interface encrypting Data or the already encrypted Calculate data and the calculated control value before encryption the one to be encrypted Data or after encryption the encrypted To attach data. Alternatively, such a control value already in the original to be encrypted Data should be included.

Based of the control value, a second network component, which a the encrypted Data about the transmission network receiving communication interface is assigned automatically easily determine if the data is complete and / or correctly decrypted were.

According to one embodiment is the decryptor moreover, trained in the encrypted data or the decrypted Data automatically identify a control value, a checksum for the means of the at least one coding key decrypted Data or the encrypted Calculate data and the checksum to compare with the control value. The data selector is designed a transmission from decrypted Data to the at least one associated communication interface automatically prevent if the checksum does not match the control value.

By Comparison of the checksum with the control value, the decryptor can be particularly simple and reliable Determine if the received encrypted data is complete and correctly decoded were. By the data selector the decrypted data only to the assigned communication interface, if the checksum with matches the control value, it is ensured that incorrectly decrypted data or incompletely received Data not received from the assigned communication interface become. Thus, the communicated to the associated communication interface Data always a predetermined minimum quality.

According to one embodiment For example, the data selector may be configured to transmit over the transmission network received unencrypted Data to the at least one associated communication interface automatically prevent.

Consequently allows the network component according to the invention just an encrypted one Data exchange with over the transmission network connected communication interfaces, each having a common given coding key must be used. Because the coding key is not an unauthorized person is known, is an attack on the associated communication interface via the transmission network not possible.

The network component may preferably have a second memory device permanently integrated into the network component, in which at least one specification of a transmission protocol used in the communication network is stored. Then, the decrypter is preferably formed into the encrypted data received via the transmission network using the stored specifications to detect an unencrypted protocol data part attributable solely to the respective used transmission protocol and an encrypted user data part containing the remaining data and to decrypt only the encrypted user data part by means of the at least one coding key.

The Providing a second memory device in which at least one Specification of a transmission protocol used in the communication network stored, allows the decryptor, in the over the transmission network received encrypted Data automatically for the data exchange used transmission protocol to identify. As a result, the log data part and the payload part is easily detected in the received data become. It is under transmission protocol a provision understood in the context of a data exchange over a transmission network the division of a data stream or a data packet into individual components such as a log data part and a payload part contains. Next contains the transmission protocol Definitions possible Values and meanings of information contained in the protocol data part Components. These components can For example, communication addresses, the size and distribution of data as well as possible Be control data. Also interactions between contents of the Protocol data part and the user data part can be specified in the transmission protocol be.

In In this case, the decryptor be further formed, using the stored specifications and the detected log data part automatically a new one Log data part for the decrypted Create user data part.

hereby can the decryptor from the new log data part and the decrypted payload part on extra simple way the decrypted data corresponding to the identified transmission protocol form. The formation of the new protocol data part can e.g. required be, if the size of the payload part and / or the division of the decrypted data into data packets.

Further can the decryptor be formed in the detected protocol data part automatically one in the transmission network for addressing a respective addressed communication interface identify the communication address used and the new one Log data part for the decrypted User data part while maintaining the detected communication address to build.

The Retaining the original used communication address in the formation of the new log data part has the consequence that the network component according to the invention from the point of view of the transmission network is transparent. It is understood by transparency that a in the protocol data part of the network component according to the invention received data address of an addressed Communication interface identical to that in a protocol data part the communication component output by the network component an addressed communication interface is. This concludes, however Do not assume that in the log data part of the network component output data contained communication address of the sending Communication interface through the network component according to the invention changed becomes. In the episode is for the integration of the network component between transmission network and associated at least one communication interface no adaptation of the transmission network required. Next, the network component needs for one Data exchange between the communication interfaces also none own, over the transmission network be assigned addressable communication address.

According to one another embodiment is the decryptor further formed over a first channel of the transmission network an unencrypted Protocol data part to receive, which protocol data part a in the respective transmission network used for addressing a respective communication interface Communication address indicates over a second, different from the first channel of the transmission network Channel of the transmission network an encrypted one Payload part to receive, which Nutzdatenteil between the communication interfaces to be transferred Contains data, and only the encrypted Nutzdatenteil by means of at least one coding key decrypt.

Consequently is the network component according to the invention also in transmission networks can be used in which a data transmission a log data part and a user data part on different channels he follows. This is for example in an ISDN communication network the case. It is obvious that the channels are not have to be physically separated but a software-implemented separation is sufficient.

Preferably, the decryptor may be further configured to automatically receive, in the protocol data part detected or received via the first channel, one in the transmission network for addressing a respective transmitting communication cation interface and to store it in the first and / or second memory device together with a key identifier which designates the coding key used for the decryption. This storage can be done for example in the form of a database.

consequently can the network component according to the invention automatically log which data transfers with which Communication interfaces using which coding key successful were.

Then can the decryptor Moreover, be formed in the detected or on the first channel received protocol data part automatically to the Addressing of a respective sending communication interface used to identify communication address, in the first and / or second memory means associated with this communication address key identifier to seek and decryption of the encrypted User data part to use the coding key associated with the respective key identifier.

hereby the selection of an encryption key suitable for decryption is considerably accelerated. The reason is that you are using coding keys that are used for data connections with a respective sending communication address in the past a successful decryption the encrypted Had data.

Of the encryptor can be further formed in the detected or on the first channel received protocol data part automatically to the Addressing of a respective addressed communication interface to identify used communication address, in the first and / or second memory means one of these communication address associated key identifier to look for and in the encryption the data to the coding key assigned to the respective key identifier use.

consequently the encryptor uses automatic coding key, which in the past has a data exchange with that of a respective one addressed communication interface associated communication address allows to have. Thus, it is automatically determined which given coding key a Enable data exchange with this communication interface.

alternative or additionally can the encryptor be configured to automatically preset test data using any predetermined stored in the first memory means coding key to encrypt and over the transmission network to send to a respective addressed communication interface, if in the first and / or second memory means none of for addressing the respective addressed communication interface used the communication address associated key identifier is stored.

there effect the test data after a successful decryption by the given coding key through the addressed Communication interface prefers the automatic transmission of a Acknowledgment of receipt. Thus, the encryptor Automatically determine which coding key one of the addressed Communication interface associated network component known is.

If in the first and / or second memory means none of the Addressing the respective addressed communication interface used Communication address associated key identifier is stored, can the encryptor according to a embodiment be further formed, automatically unencrypted user data, all or a subset of those in the first and / or second storage means specify key IDs stored on the network component over the transmission network to send a respective addressed communication interface.

The Sending unencrypted Payload, all, or a subset of in the network component stored key identifiers is not critical because the key identifiers only encode the keys denote and not included. As a result, interception or interception of the unencrypted sent key codes not to allow an unauthorized person to data by means of the coding key too encode or decrypt.

The decryptor can then be further configured to automatically compare the specified key identifiers with all the key identifiers stored in the first and / or second memory device of the network component upon receipt of unencrypted payload data via the transmission network that specify a plurality of key identifiers, in which the received payload data is associated detected or received via the first channel protocol data part to identify the communication address used for addressing a respective transmitting communication interface, and sen via the transmission network to the respective transmitting communication interface unencrypted user data sen those that contain all common key identifiers.

Of the descrambler may then be further formed upon receipt of unencrypted User data via the transmission network, the common key identifiers specify automatically detected in the received payload associated or over the first channel received protocol data part for addressing a respective sending communication interface used Identify communication address, and together with the common key identifiers store in the first and / or second memory device.

In the episode can assigned to different communication interfaces Network components according to the invention automatically without user intervention on the use of reciprocal known coding keys some, without a transmission the coding key over the transmission network is required. By storing the respective sending Communication interface associated communication address together with the respective common key identifier becomes automatic ensures that the network component according to the invention for a mutual data exchange with this communication address in the future coding used, which is assigned to the common key identifier.

Of the encryptor is according to one embodiment further formed in which of the at least one associated Communication interface received data using the stored specifications automatically only on the respective used transmission protocol attributable Protocol data part and a user data part containing the other data to detect and only the Nutzdatenteil means of at least a coding key to encrypt.

By doing only the user data part is encrypted, it is ensured that the log data part for the transmission network and with the transmission network connected communication interfaces remains readable.

Then can the encryptor be further formed, using the stored specifications and the detected log data part automatically a new one Protocol data part for the encrypted Create user data part.

There the detected protocol data part usually the the respective transmission protocol relevant essential information such as the Communication addresses of the sending and receiving communication interfaces contains The new log data part can be formed in a particularly simple way become. This is usually just an adaptation to the new size of the encrypted Data and the distribution of the encrypted data into data packets required. Consequently, even after the encryption match those from the new protocol data part and the encrypted one User data part formed encrypted Data to the respective transmission protocol of the respective transmission network.

Further can the encryptor be formed in the detected protocol data part automatically one in the transmission network for addressing a respective addressed communication interface identify the communication address used and the new one Log data part for the encrypted User data part while maintaining the detected communication address to build.

consequently is the network component according to the invention also for transmitted from the associated communication interface to the transmission network Data transparent.

The first memory device and / or the second memory device can be a non-volatile memory permanently integrated into the network component be.

By doing the first and second storage means in the network component permanently integrated, can not inconspicuous solved by the network component to read stored data. Next is the network component according to the invention such an autonomous system.

Further the network component can have a management device, which is designed to make adjustments to the network component.

The For example, settings made by the management device may States of the descrambler, the encryptor or the data selector. Next can in the first and / or second storage device contained data by the management device manipulated and managed in particular given coding key become. In particular, the management device may also be used for monitoring and maintenance of the network component.

The management device can be assigned a communication address that can be addressed via the transmission network. Further, the management device may communicate with the transmission network to exchange management data to be those.

Consequently is a configuration and maintenance of the network component according to the invention over with the transmission network connected management facility possible. There is a data transfer from and to the management device also prefers using from encrypted Data instead, by means of a special predetermined coding key through the management device is automatically encrypted or decrypted.

The Network component may be a first identification system for detection the identity of a User, the identification system only after successful Identification of a user reading the memory and / or a activity of the management system.

In hang the episode all essential functions of the network component of the invention successful identification of a user. Especially allows the network component according to the invention only a successfully identified user a data exchange between the associated communication interface and the transmission network.

According to one embodiment the first storage device is a removable nonvolatile storage medium and the network component has a storage interface for the removable storage medium on. Next is the second memory device in this embodiment a non-volatile integrated into the network component Storage.

This allows a particularly simple and flexible distribution of the given Coding. For example, you can various storage media provided with different predetermined coding keys become. Dependent on of which storage medium with which coding keys on the Memory interface is connected to the network component, the network component is able to communicate with a different circle of connected via the transmission network Communication interfaces and associated network components perform. Thus, you can For example, a working group in a company always this one Working group assigned data connections provided regardless of which communication interfaces of members of the working group for the Data exchange is currently being used. This is done by that the members of the working group simply assigned theirs given coding key on the removable storage medium and the memory interface into one load respective network component.

there The removable storage medium can be a floppy disk, a Compact Disc CD, a Digital Versatile Disc DVD, a smart card or a Be a USB token.

such removable storage media are inexpensive, widely used and have sufficient reliability and robustness.

The removable storage medium may preferably be a second identification system for establishing the identity a user, wherein the identification system a Reading out the removable storage medium only after successful Identification of a user permits.

at changeable non-volatile Storage media is generally at risk of being on the storage media stored data can be read out by unauthorized persons when the storage media be stolen or lost. This is critical when on the storage media sensitive data as given in the present case coding are stored. An unauthorized reading of the storage media is prevented or significantly by the second identification system difficult.

Further can be assigned to the removable storage medium an individual storage medium identifier and the encryptor be formed, automatically the storage medium identifier one via the memory interface for the removable storage medium connected to the network component removable storage medium read and the read storage medium identifier the to be encrypted Data or the encrypted Add data. Preferred may the encryptor and the decryptor also be formed, a storage medium identifier added to a received data read out and instead of one identified in the received data Communication address to use.

As already executed, allows the use of removable storage media to a user, by reading the stored on the removable storage medium given coding key in a network component a data exchange by means of any this network component associated communication interface perform. Since this is the communication address of the communication interface dependent on changes from the used network component, it allows to attach the Storage medium identifier to the transmitted Data to identify the user in a particularly simple way.

The Identification system can be a keyboard for entering a personal Identification codes and / or a sensor for detecting biometric Have data.

Further the network component may have an individual network component identifier be assigned. Then the encryptor can be formed automatically to read out the network component identifier and to encrypt it Data to add the network component identifier of the network component.

This allows easy evaluation of which network component for one Data exchange was used.

According to one embodiment can the coding keys stored in the first storage means, respectively Metadata and metadata information about the Way of using the respective coding key included. additionally or alternatively be stored in the second storage device metadata, the each of a key identifier a coding key assigned.

Of the descrambler, the encryptor, the data selector and preferably the management device may be in be integrated with a microprocessor.

This allows a particularly cost-effective implementation the network component according to the invention.

there the microprocessor may preferably have an operating system, that of an operating system of the at least one associated communication interface is different.

hereby is the network component according to the invention especially good against manipulation by unauthorized persons over the transmission network protected, as the unauthorized the construction of the operating system is not known is. Next is the way the network component according to the invention works Even if an operating system, which of the assigned communication interface, an error or a weak spot.

According to one In another aspect, the present invention relates to a communication network which a communication network enabling a data exchange and a plurality of with the transmission network having associated communication interfaces. Here are the Communication interfaces for data exchange over the transmission network formed. The communication network further comprises at least two network components with the features of one of claims 1 to 38. The network components are each assigned to at least one communication interface, as well as between the respective assigned communication interface and the transmission network arranged.

is in the respective first and / or second memory devices the at least two over the transmission network connected network components at least one common coding key stored, so can the communication interfaces associated with the two network components Data about the transmission network change. Since this data exchange is encrypted, a listening or a manipulation by an unauthorized person is not possible or at least considerably more difficult. about this encryption or decryption the one to be transferred Data take the network components, the communication network according to the invention without User intervention implicitly an activation or blocking of data transmission paths between assigned communication interfaces. These implicit Data transmission paths overlay the transmission network. By having the network components receive a forward from unencrypted Prevent data from being assigned to the respective communication interface is also an access of an unauthorized person to these communication interfaces effectively prevented.

there can at least one of the at least two network components between a plurality of communication interfaces associated with this network component and the transmission network be arranged.

Consequently can the network component according to the invention also connect more than one communication interface with the transmission network. For example, such a subnetwork can be integrated into the transmission network become.

Further can be the communication interfaces of the communication network for addressing in the context of mutual data exchange respectively be assigned a unique communication address, the Network components are designed so that the respective communication address the assigned communication interface for the transmission network is visible.

consequently are the network components of the communication network according to the invention for the transmission network preferably transparent.

According to one embodiment, the Communication interfaces are adapted to encode data to be transmitted before an output to the respective associated network component according to a transmission protocol used by the transmission network. In this case, the network components are designed to process (encrypt or decrypt) the data received from the respective associated communication interface in such a way that the processed data are also coded in accordance with the protocol used by the transmission network.

Everyone Communication interface can be assigned a communication addresses be the transmission network Switches and / or routers may have, which on the basis of the communication address targeted data channels between the communication interfaces.

there can the transmission network an IEEE802.3 preferred between the communication interfaces Ethernet connection or an IEEE802.11 wireless LAN connection or an ISDN connection or a GSM connection or a UMTS connection or provide a TCP / IP connection.

Consequently can the communication network according to the invention on the usual previously known transmission networks build up.

According to one embodiment The network component may be one of each associated Communication interface be separate device.

This allows a simple construction of the communication network according to the invention based on an existing network by arranging the network component according to the invention between a respective at least one associated communication interface and the transmission network.

According to one Another aspect of the present invention includes a method for providing a data connection between at least two over a transmission network interconnectable communication interfaces, wherein between at least two of the communication interfaces and the transmission network each a network component is provided, the following steps on: receiving from a communication interface via the transmission network sent encrypted Data through the respective network component before output of the data to the respective communication interface. Decrypt the received encrypted Data using at least one predetermined encoding key. And Forward the decrypted Data through the network component to the respective communication interface to provide a data connection if the encrypted Data can be decrypted by means of the at least one coding key are.

By doing according to the invention the network component only data to the associated respective communication interface be forwarded, which using at least one predetermined coding key decrypts can be provides the inventive method in dependence from the given coding keys over the transmission network implicitly only data connections to communication interfaces ago, which data to be sent by means of at least one same predetermined coding encrypt.

there the method may further comprise the steps of: identifying from one to the other the transmission network received encrypted Data contained key information, which one for the encryption used coding key features. And using the one of the given coding keys, which the identified key information corresponds to decrypt the data.

Further The method may include the following steps: Encrypt the to be transmitted through a communication interface via the transmission network Data before output of the data to the transmission network by the network component using the at least one predetermined encoding key. And edition the encrypted Data to the transmission network.

Further The process may be the step of adding an encryption key used coding key significant key identifier to the encrypted Data before the transmission of the encrypted data to the transmission network exhibit.

According to one embodiment the method further comprises the steps of calculating a control value for the to be encrypted Data and adding the control value to the data to be encrypted before encryption or to the encrypted Data after encryption on.

Further, the method may include the steps of: identifying a control value in the encrypted data or the decrypted data. Calculating a checksum for the data decrypted by the at least one coding key. Compare the checksum with the control value. And preventing transmission of the decrypted data to the at least one associated communication interface if the checksum does not match the control value.

The following steps can in the method according to the invention be further provided: receiving from a communication interface via the transmission network sent unencrypted Data through the respective network component. Realize that received data is not encrypted by means of a given coding key. And preventing a transmission the received unencrypted Data to the at least one associated communication interface through the network component.

The The method may further comprise the steps of: identifying one in the transmission network used transmission protocol on the basis of the transmission network received encrypted Data using specifications of known transmission protocols. detect one due only to the particular transmission protocol used unencrypted Protocol data part and an encrypted containing the other data Payload part in the received encrypted data. And decrypting only the encrypted user data part by means of the at least one coding key.

Then can Continue the steps of creating a new history data part for the decrypted Payload part using the specification of the identified transmission protocol and the detected protocol data part and forming the identified transmission protocol accordingly decrypted Data from the new log data part and the decrypted payload part be provided.

Further can the steps of identifying one in the transmission network for addressing a respective addressed communication interface used Communication address in the detected protocol data part and of the new log data part for the decrypted User data part while maintaining the detected communication address be provided.

According to one embodiment the method further comprises the following steps: receiving an unencrypted Log data part about a first channel of the transmission network, which protocol data part one in the respective transmission network used for addressing a respective communication interface Communication address indicates. And receiving an encrypted Nutzdatenteils about a second, different from the first channel of the transmission network Channel of the transmission network, which user data part between the communication interfaces to be transferred Contains data. Then only the preferred over the second channel received user data part using the decrypted at least one given coding key.

The Steps of identifying one in the transmission network for addressing a respective transmitting communication interface used Communication address in the detected or received over the first channel Protocol data part and the assignment of the identified communication address to a key identifier, the the for the decryption used coding key designated after decrypting the received payload part can be further provided.

Further For example, the method may include the steps of: identifying one for addressing a respective transmitting communication interface used communication address in the detected or via the first channel received protocol data part of the data to be decrypted. Search for a key identifier assigned to this communication address. And using the encoding key associated with the respective key identifier in the decryption the data.

According to one embodiment can further comprising the steps of: identifying a in the transmission network used transmission protocol on the basis of the at least one associated communication interface received unencrypted Data using specifications of known transmission protocols. Detecting a due solely to the particular transmission protocol used Protocol data part and one of the remaining data containing Nutzdatenteils in the received data. And encrypting only the payload part by means of the at least one coding key.

Then can Continue the steps of creating a new history data part for the encrypted Payload part using the specification of the identified transmission protocol and the detected protocol data part and forming the identified transmission protocol accordingly encrypted Data from the new log data part and the encrypted payload part be provided.

The method may further include identifying one in the transmission network for addressing tion of a respective addressed communication interface used in the detected protocol data part and forming the new protocol data part for the encrypted user data part while maintaining the detected communication address.

Further can identifying one addressed for addressing a respective one Communication interface used in the detected or over the first channel received log data part, a search one this key address associated key identifier and use of the respective key identifier associated coding key in the encryption be provided.

If for addressing the respective addressed communication interface the communication address used is not assigned a key ID, The method may further comprise the steps of: encrypting given test data using any given coding key and sending the encrypted Test data to a respective addressed communication interface.

alternative The method can be used when addressing the addressed Communication interface used no communication address key identifier is assigned, continue to create unencrypted Payload, the key identifiers which designates all given coding keys, and a transmission the unencrypted User data to a respective addressed communication interface provide.

According to one embodiment the method further comprises the following steps: that over the transmission network unencrypted User data has been received indicating multiple key identifiers. to compare the multiple key identifiers, those in the received unencrypted User data are given, with the predetermined coding key indicative Key identifiers. Identifying one for addressing a respective sending communication interface used communication address in the detected or over the first Channel received log data part to the received unencrypted Payload. Create unencrypted payload, all common key identifiers specify. And sending the unencrypted user data to a respective one sending communication interface.

Then can Further, the following steps may be provided: determining that via the transmission network unencrypted User data has been received indicating common key identifiers. Identify one used for addressing a respective transmitting communication interface Communication address in the detected or received over the first channel Log data part of the received unencrypted user data. And assign the identified communication address to the common key identifiers.

According to one embodiment the method further comprises the following steps: determination of identity a user. Comparison of Identified Identity with the identities allowed user. And performing a decryption or encryption by means of the at least one predetermined coding key only, if the identified identity associated with a permitted user.

The described method steps may preferably by means of a Network component according to one of claims 1 to 38 are executed.

in the The following are preferred embodiments of the present invention with reference to the accompanying drawings described. As far as possible the same or similar reference numbers have been used in the drawings on the same or similar To reference elements. It shows

1 schematically the structure of a communication network according to a preferred embodiment of the present invention;

2 schematically the structure of a network component according to the preferred embodiment of the present invention;

3A schematically the structure of data which can be transmitted via a first transmission network;

3B schematically the structure of data which can be transmitted via a second transmission network; and

4A . 4B a flow chart of a preferred embodiment of the method according to the invention for providing a data connection.

In the following, with reference to the accompanying drawings, a preferred embodiment of the network component according to the invention, the communication network according to the invention and the inventive method for providing a data connection between at least two via a transmission network interconnected communication interfaces described.

The communication network 1 has a transmission network 20 on, with which a first to ninth communication interface 31 - 39 connected is. Between the first to the fifth communication interface 31 to 35 and the transmission network 20 is in each case a first to fifth network component 11 - 15 arranged. Between the sixth and seventh communication interface 36 and 37 and the transmission network 20 is a common sixth network component 16 arranged.

The first to sixth network components 11 - 16 each has a first interface 61 as well as a second interface 62 on. The first to seventh communication interface 31 - 37 is each with the first interface 61 the associated first to sixth network components 11 - 16 connected. About the second interface 62 are the respective network component 11 - 16 with the transmission network 20 connected. Every communication interface 31 - 39 is dependent on one in the transmission network 20 used transmission protocol associated with a communication address.

In the in 1 embodiment shown represents the transmission network 20 a TCP / IP connection between the connected first to ninth communication interfaces 31 - 39 ready to exchange data between principally all communication interfaces 31 - 39 to enable. The transmission network 20 points in 1 switches and / or routers, not shown, which selectively use the communication addresses data channels between the communication interfaces 31 - 39 provide. Here are the network components 11 - 16 each formed so that the respective communication address of the at least one associated communication interface 31 - 37 for the transmission network 20 is visible and thus from the transmission network 20 furthermore for addressing the respective assigned communication interface 31 - 39 can be used.

Alternatively, the transmission network 20 but also another data network or communication network enabling digital data transmission such as an IEEE 802.3 network, or an IEEE 802.11 WLAN network, an ISDN network, a GSM network or a UMTS network.

Accordingly, the first to ninth communication interface 31 - 39 formed for data exchange over a TCP / IP network and encode data to be transmitted before an output according to one of the transmission network 20 used transmission protocol.

In 1 are the first, second, fourth and eighth communication interfaces 31 . 32 . 34 . 38 each network card of a personal computer. The third and fifth communication interfaces 33 and 35 are as well as the ninth communication interface 39 Network cards from servers. The sixth and seventh communication interface 36 and 37 are each with a corresponding first interface 61 the associated sixth network component 16 connected wireless cards. Depending on a transmission network used, the communication interfaces can, for example, also be an ISDN modem or the like.

In 1 are the first, second, third and sixth network components 11 . 12 . 13 and 16 from the associated communication interfaces separate devices in a line between the respective communication interface 31 . 32 . 33 . 36 and 37 and the transmission network 20 are interposed. The fourth and fifth network components 14 and 15 on the other hand, is fixed in an associated fourth or fifth communication interface 34 and 35 integrated. This can be done for example in the form of a PCI bus card or directly on the motherboard of the corresponding computer.

Each network component has a first storage device 41 in which at least one predetermined coding key is stored. In 1 are in the first storage device 41 the first and second network components 11 and 12 in each case the coding keys K1 and K3 ge stores. In the first storage device 41 the third network component, the coding keys K1 and K2 are stored. In the first storage device 41 the fourth network component 14 is the coding key K3, in the first memory device 41 the fifth network component 15 are the coding keys K1, K2 and K3 and in the first memory device 41 of the sixth network component, the coding key K1 is stored.

In 3A schematically is the structure of in the transmission network 20 transmitted data shown.

As can be seen, the data comprises a protocol data part and a payload part. The protocol data part depends on one in the transmission network 20 each used transmission protocol and contains inter alia the communication address of an addressed communication interface 31 - 39 and the communication address of the sending communication interface 31 - 39 , Around a transmission over the transmission network 20 to enable the protocol data part is always unencrypted, ie only according to one in the transmission network 20 used transmission protocol encoded.

Of the User data part can be encrypted or unencrypted be and contain in addition to the payload data in the example shown a control value, which is calculated from the payload and allows the determination whether the user data part is complete and is error free. Preferably, the control value also allows one Correction of a defective user data part. Are the payload encrypted contains the payload part in the embodiment shown also an unencrypted key identifier, which one for the encryption used coding key K1, K2, K3 marks.

In the 3A data shown may be in the transmission network 20 out 1 be transmitted, which uses a common channel for the data to be transmitted.

3B however, shows the structure of data that can be used in a data network that uses different channels to transmit a protocol data part and a payload part of the data to be transmitted. This is the case, for example, in ISDN networks in which the protocol data part is transmitted via a first channel and the user data part via a second channel.

The structure of the protocol data part and the user data part corresponds in each case to that of 3A , It is emphasized, however, that the present invention is not limited to those disclosed in the 3A and 3B shown data structure is limited.

In 2 is schematically the structure of one of in 1 used network components 11 - 16 shown schematically according to the preferred embodiment.

In the 2 shown first network component 11 points next to the first interface 61 and the second interface 62 a memory interface 43 , a decoder 51 , a data selector 52 , an encryptor 53 , a second storage device 42 , a first identification system 71 and a management facility 54 with a third interface 63 on. Alternatively, the management device may not have its own interface and instead interface 62 access.

Next assigns the network component 11 in 2 not shown auxiliary systems such. B. a power supply and a display or one or more indicator lamps for displaying an operating condition. The in 2 shown components of the network component 11 An additional controller can also be superimposed. The components are interconnected via data lines. be from a housing 10 added.

The first storage device 41 is not an integral part of the network component in the example shown 11 but with this via the memory interface detachably connectable. In the first storage device 41 is a second identification system 72 integrated.

At the decryptor 51 , the data selector 52 , the encryptor 53 , the first identification system 71 as well as the second identification system 72 each are programmably suitably configured microprocessors. These microprocessors include an operating system, that of an operating system of the associated first communication interface 31 is different.

In 2 are the first and second interfaces 61 . 62 each Ethernet interfaces.

Alternatively, the first interfaces 61 for example, a PCMCIA interface or the like and the second interfaces 62 a WLAN or ISDN interface or similar. It is only necessary that the first interface 61 a connection to the assigned communication interface 31 and the second interface 62 a connection to the transmission network 20 allows.

About the first interface 61 and the second interface 62 receives or sends the network component 11 Data to / from the associated first communication interface 31 or the transmission network 20 ,

Where is the network component 11 configured such that the communication address of the associated first communication interface 31 (Network card of the personal computer) for the transmission network 20 is visible and that of the first communication interface 31 outputted data are previously processed so that also the processed data corresponding to that of the transmission network 20 used protocol are coded.

In the illustrated embodiment, the first storage device is 41 a removable nonvolatile storage medium in the form of a USB token 41 , Corresponding to the memory interface 43 a USB interface 43 for the USB token 41 on. Alternatively, the first storage device 41 ever however, for example, a floppy disk, a compact disc CD, a digital versatile disc DVD, a chip card or a magnetic card and the memory interface be adapted accordingly.

That in the USB token 41 integrated second identification system 72 serves to determine the identity of a user and has a (not shown) sensor for detecting biometric data. The second identification system 72 gives access to the USB token 41 Saved data only after successful identification of a user.

The USB token 41 stores the given coding keys K1 and K3 as well as the coding keys K1, K3 designating key identifications. These key identifiers are from those for addressing a respective communication interface 31 - 37 used communication addresses different. However, each key identifier can be assigned a communication address and / or a storage medium identifier and / or a network component identifier. Further, in the USB token to the coding keys K1, K3 respectively metadata are stored, which contain information about the manner of using the respective coding key K1 and K3. For this purpose, the metadata are each assigned to a key identifier of a coding key K1, K3. Furthermore, an individual storage medium identifier is stored in the USB token.

Although symmetric coding key preferred can, can also asymmetric coding keys be used.

The second storage device 42 is one in the network component 11 permanently integrated, nonvolatile memory, in the specifications of in the transmission network 20 of the communication network 1 used transmission protocols are stored. Next is the network component 11 an individual network component identifier assigned in the second memory device 42 is stored. In the embodiment shown, the second storage device is 42 a FLASH memory.

Alternatively or additionally, in the second memory device 42 also be stored coding key and these distinctive key identifications. This enables autonomous operation of the network component according to the invention. In this case, the first storage device can also be completely integrated into the second storage device.

The encryptor 53 is designed to encrypt data received from the associated first communication interface 31 over the first interface 61 be received. The encryptor uses this 53 one of the first and / or second storage means 41 stored coding K1, K3.

The encryptor reads before encryption 53 via the USB interface 43 from the USB token 41 a storage medium identifier and the second storage device 42 a network component identifier and optionally adds it to the data to be encrypted. Next calculates the encryptor 53 , before encryption, automatically sets a control value for the data to be encrypted and adds the calculated control value to the data to be encrypted.

In order to select a coding key K1, K3 suitable for a data exchange, the encryptor reads 53 from the second storage device 42 Specifications of transmission protocols and detected in the data to be encrypted using the specifications automatically a merely due to the respective transmission protocol used to be attributed protocol data part and a data portion containing the remaining data. In the log data part, the encryptor identifies 53 automatically one for addressing a respective addressed communication interface 32 - 37 used communication address and searches in the first memory device 41 one of these communication address associated key identifier. Is in the first storage device 41 stored one of this communication address associated key identifier, so encrypted the encryptor 53 the user data part using the coding key K1 or K3 associated with this key identifier and automatically adds the respective key identifier of the coding key K1, K3 in unencrypted form to the encrypted user data part.

To prevent the from the encryptor 53 used encoding key K1, K2, K3 can be determined by analyzing encrypted data, the encryptor adds 53 automatically add random data to the user data to be encrypted in a data area of the user data part, which are also encrypted. The data area filled with the random data is from the encryptor 53 indicated before the encryption in the payload part. The addition of random numbers ensures that identical data, which is encrypted with the same coding key and the same encryption algorithm, nevertheless leads to different encrypted data. A determination of the coding key used by analysis of encrypted data is not possible or very difficult.

After encryption, the encryptor 53 optionally enclose the encrypted user data unencrypted with the read-out storage medium identifier and network component identifier. Next forms the encryptor 53 automatically using the read out specifications and the detected log data part, a new log data part for the encrypted payload part. The encryptor uses this 53 the identified communication address of the addressed communication interface 32 - 37 and forms the new protocol data part for the encrypted payload part while maintaining the identified communication address.

If in the first storage device 41 no key identifier associated with the communication address is stored, the encryptor sends 53 over the second interface 62 and the transmission network 20 to a respective addressed communication interface 32 - 37 automatically unencrypted payload, all in the first storage device 41 specify stored key identifiers.

If different coding keys can optionally be used for an encryption, then the encryptor uses 53 automatically in the USB token 41 stored coding K1, K3, which promises the most secure encryption (eg the longest coding key).

The decryptor 51 is for decrypting over the second interface 62 from the transmission network 20 received encrypted data formed. The decryptor reads for this 51 from the second storage device 42 Specifications of transmission protocols and detects in the encrypted data using the specifications an unencrypted log data part and an encrypted user data part. Next, the decryptor identifies 51 in the received encrypted data, automatically the key identifier which identifies the coding key K1, K2, K3 used for the encryption. Subsequently, the decryptor decrypts 51 the encrypted user data part by means of the at least one coding key K1, K3, which is characterized by the identified key identifier.

Next is the decryptor 51 designed to automatically identify a control value in the encrypted data or the decrypted data, to calculate a checksum for the data decrypted by the at least one coding key K1, K3 and to compare the checksum with the control value. If the checksum matches the control value, the decryptor identifies 51 in the detected protocol data part automatically in the transmission network 20 for addressing a respective sending communication interface 32 - 37 used communication address and assigns this communication address of the stored in the USB token key identifier of the encryption key used for decryption K1, K3. Optionally, the decryptor 51 in the detected user data part also read a storage medium identifier and network component identifier and additionally assign the key identifier of the coding key used K1, K3.

Next the decryptor detects 51 in the detected protocol data part automatically in the transmission network 20 for addressing a respective addressed communication interface 32 - 37 used communication address and the forms a new protocol data part for the decrypted Nutzdatenteil while maintaining the detected communication address.

If no key information can be identified in the received encrypted data, the decryptor identifies 51 in the detected protocol data part automatically for addressing a respective transmitting communication interface 32 - 37 used communication address or in the detected Nutzdatenteil a storage medium identifier or network component identifier and searches in the USB token or internal memory 42 one of this communication address or storage medium identifier or network component identifier associated key identifier. If there is an associated key identifier, the decryptor uses it 51 the corresponding coding key K1, K3 for decrypting the payload part of the encrypted data.

Alternatively, the decryptor 51 also a decryption with all in the USB token 41 or internal memory 42 try the stored coding keys.

Receives the decryptor 51 over the second interface 62 from the transmission network 20 on the other hand, unencrypted user data, which specify several key identifiers, the decryptor compares 51 Automatically the specified key identifiers with all in the USB token 41 or internal memory 42 stored key identifiers and identified in the received payload associated detected protocol data part for addressing a respective transmitting communication interface 32 - 37 used communication address. Then the decryptor sends 51 over the second interface 62 and the transmission network 20 to the respective sending communication interface 32 - 37 without keyed user data, all common key IDs and optionally the storage medium ID of the USB token 41 and / or the network component identifier of the network component 11 contain.

Receives the decryptor 51 over the second interface 62 from the transmission network 20 unencrypted payloads that specify common key identifiers are identified by the decryptor 51 automatically in the received data the associated protocol data part for addressing a respective transmitting communication interface 32 - 37 used communication address and assigns it in the USB token 41 stored common key identifiers. Optionally, the decryptor 51 in the detected payload part also read a storage medium identifier and network component identifier and the in the USB token 41 Assign stored common key identifiers.

The data selector 52 is used to selectively transfer data between the transmission network 20 and the associated first communication interface 31 , This is the data selector 52 with the first and second interfaces 61 and 62 , the encryptor 53 , the decoder 51 and the first identification system 71 connected.

The data selector 52 prevents automatic forwarding from the second interface 62 received encrypted data to the first communication interface 31 if the encrypted data is not encrypted by the decryptor 51 can be decrypted by means of the at least one coding K1 K3. The data selector derives accordingly 52 encrypted data after a successful decryption by the decryptor 51 automatically to the assigned first communication interface 31 further. Whether a decryption was successful is from the data selector 52 by comparing the decryptor 51 from the decrypted payload calculated checksum with that of the decryptor 51 assessed in the decrypted data. For a successful decryption, checksum and control value must match.

To prevent unauthorized access by a third party to the associated first communication interface 31 to effectively prevent, the data selector prevents 52 generally a transmission of over the transmission network 20 received unencrypted data to the first communication interface 31 ,

Next poses the data selector 52 sure that from the associated first communication interface 31 received data only after encryption by the encryptor 53 by means of the at least one coding key K1 K3 to the transmission network 20 be issued.

The management facility 54 allows settings on the components of the network component 11 make. This is indicated by the management facility 54 a third interface 63 on which the management facility 54 for exchanging management data with the transmission network 20 and is the management body 54 one over the transmission network 20 assigned addressable communication address. The communication address of the management facility 54 is from the communication address of the associated first communication interface 31 different. In this way, status monitoring and maintenance work on the network component according to the invention 11 performed and the network component 11 optionally remotely controlled. Also, manipulate the in the with the USB interface 43 connected USB token 41 and / or the second storage device 42 stored data is by means of the management device 54 possible. In this way, the management facility 54 the network components 11 optionally return to a delivery state (reset function). In order to ensure sufficient security, the management device receives and sends 54 encrypted data exclusively by means of a special predetermined coding key. The specially specified coding key of the management device 54 can be directly in the management facility 54 or the second storage device 42 be saved.

Next reads the management facility 54 regularly in the with the USB interface 43 connected USB token 41 stored data. If specially coded management commands are stored in the USB token, then the management device performs 54 these commands automatically.

The first identification system 71 is fixed in the network component 11 integrated and serves to establish the identity of a user. This is indicated by the first identification system 71 in the embodiment shown, a keyboard (not shown) for inputting a personal identification code. The first identification system 71 Make sure that reading is done with the USB interface 43 connected USB token 41 and the second storage device 42 only after successful identification of a user. Also an access of the management system 54 to the decryptor 51 , the data selector 52 or the encryptor 53 leaves the first identification system 71 only after successful identification.

In the preferred embodiment described above, a transmission network 20 used in which transmission of a protocol data part and a payload part of the data (as in 3A shown) together. Alternatively, but also a transmission network 20 in which transmission of a protocol data part and a payload part of the data (as in 3B shown) via different channels he follows. In this case, the decryptor will receive 51 or the encryptor 53 a non-encrypted protocol data part via a first channel of the transmission network and an encrypted user data part via a second channel, which differs from the first channel of the transmission network. A determination of protocol data part and payload part using a specification of a transmission protocol is thus not necessary. The log data part and the payload part are then decrypted by the decryptor 51 or the encryptor 53 processed as described above.

In the preferred embodiment, the decryptor 51 , the encryptor 53 , the data selector 52 , the first identification system 71 and the management facility 54 separate components. Alternatively, however, these components may be integrated into a common microprocessor. In this case, an operating system of the microprocessor is preferably different from an operating system of the associated communication interface 31 ,

Next are the decryptor 51 , the encryptor 53 , the data selector 52 , the first identification system 71 , the USB interface 43 , the second storage device 42 and the management facility 54 in the in 2 shown embodiment connected to each other via individual data lines. Alternatively, these components may be the network component 11 also be connected via a common data bus.

The remaining network components 12 - 16 of in 1 shown communication network 1 have the same structure as the first network component described above 11 on.

Because of that in the first network component 11 connected USB token 41 stored predetermined coding K1 and K3 is thus a data exchange with the second to seventh communication interface 32 - 37 possible, as well as the associated second to sixth network components 12 - 16 each have one of the coding K1 and / or K3.

A data exchange between the third communication interface 33 and the fourth communication interface 34 is in the in 1 However, for example, not shown, because the associated third and fourth network components 13 and 14 do not have a common coding key. Also, a data exchange with the eighth and ninth communication interface is not possible because they have no network component and thus can not send or receive encrypted with a given encoding key data.

Thus, the network components according to the invention overlap 11 - 16 the transmission network 20 a network of encrypted and thus secure data connections between the network components 11 - 16 assigned communication interfaces 31 - 37 , The structure of the network, ie the definition of which communication interfaces 31 - 37 with each other via the transmission network 20 Data exchange depends solely on those in the assigned network components 11 - 16 respectively stored coding keys K1, K2, K3. An intervention of a user beyond the provision of the coding keys is thus not necessary for the construction of the network.

By suitable distribution of first storage devices 41 with coding keys K1, K2, K3 stored therein to authorized persons, the data exchange between the communication interfaces 31 - 37 be controlled in a particularly simple, flexible and secure manner. For example, in a transmission network 20 dynamically set workgroups that have specific reciprocal access rights.

Although in the example described above, in the first memory devices 41 the network components 11 - 16 If only one to three coding keys K1, K2, K3 are stored, it is obvious to a person skilled in the art that an arbitrarily large number of coding keys can be used.

External access to a secondary network can also be achieved by means of the network components according to the invention 11 - 16 to be provided. For this purpose, access points / dial-in systems of a dial-up network corresponding to the transmission network are network components according to the invention 11 - 16 intended. Each network component 11 - 16 has a removable storage medium with at least one stored predetermined coding key. Also between an access to the secondary network enabling server and the dial-up network is a fiction, proper network component 11 - 16 arranged with a corresponding coding key. On the match of the coding key can be controlled, which with the network components 11 - 16 connected / connectable communication interfaces 31 - 37 Access to the server and thus the secondary network received. In this case, an assignment of access to a user (for example, for billing purposes) is possible when reading from individual storage medium identifiers of the removable storage media.

The following is with reference to the 4A and 4B a preferred embodiment of the method according to the invention for providing a data connection between at least two via a transmission network 20 interconnectable communication interfaces 31 . 32 . 33 . 34 . 35 . 36 . 37 described.

In this case, the embodiment using the example of a provision of a data connection between the two in 1 over the transmission network 20 interconnected second and fourth communication interfaces 32 and 34 described. Between the two communication interfaces 32 . 34 and the transmission network 20 is in each case a second or fourth network component 12 respectively. 14 intended.

It is going on first 4A directed.

To provide a data connection gives the fourth communication interface 34 (for example as a result of user input) data being transmitted over the transmission network 20 to the second communication interface 32 to be transferred. The fourth communication interface codes 34 the data to be transmitted automatically so that they are one in the transmission network 20 correspond to the transmission protocol used. This means that the data to be transmitted in the example have a protocol data part which contains a communication address of the addressed second communication interface 32 contains.

Because the fourth network component 14 between the fourth communication interface 34 and the transmission network 20 is arranged, receives in a first step (S1) from the fourth communication interface 34 the data to be transferred.

After that is automatically used based on the received data to be transmitted Specifications of known transmission protocols one in the transmission network used transmission protocol identified (S2). This can be done in the simplest case by determining a packet size of the data respectively.

Subsequently, will in the data to be transferred automatically a simply due to the used transmission protocol Protocol data part and one containing the actual user data Payload part detected (S3).

Thereafter, in the detected protocol data part is automatically one for addressing the second (addressed) communication interface 12 used communication address identified (S4) and a key identifier associated with this communication address searched (S5). This can be done, for example, by searching a database in which information about past successful data connections is stored. In the present case, it is assumed that the addressed communication address is assigned a key identifier that identifies the coding key K3.

Subsequently, will automatically a control value for the ones to be transferred Data is calculated (S6) and added to the data to be transmitted (S7). The control value is preferably calculated from the payload data to be transmitted, that integrity the data will be checked can.

Subsequently, will the payload part of the to be transmitted Data automatically using this key identifier associated coding key K3 and a known encryption algorithm encoded (S8) and a coding key K3 used in the encryption significant key identifier to the encrypted User data part unencrypted added (S9).

In this case, according to an alternative embodiment, the method may additionally comprise the steps of identifying one in the transmission network 20 for addressing the transmitting fourth communication interface 34 used communication address in the detected protocol data part and / or identifying a storage medium identifier or Netwerkkomponente identifier in the detected Nutzdatenteil. After successful identification, the identified communication address or the identified storage medium identifier or network component identifier is assigned to a key identifier, which designates the encryption key K3 used for the decryption. As a result, even with a later provision of data connections between the two fourth and second communication interfaces 32 . 34 automatically a suitable coding key K1, K2, K3 are selected for the encryption.

The data encrypted in this way automatically becomes the transmission network 20 outputted (S10).

there includes the output of the decrypted Data an automatic creation of a new log data part for the encrypted Payload part using the specification of the identified transmission protocol and the detected protocol data part to the identified transmission protocol corresponding encrypted data to build. In the process, the detected communication address is included the formation of the new log data part is preferably maintained.

The above method steps S1-S10 become, in the example, the fourth network component 14 executed.

The data is from the transmission network 20 automatically using the communication address and the respective transmission protocol to the second communication interface 32 transfer. Because the second network component 12 however between the second communication interface 32 and the transmission network 20 is arranged, receives the second communication interface 32 the encrypted data not directly, but via the second network component 12 , This requires that the second network component 12 from the perspective of the transmission network 20 is transparent.

Thus, in 4B through the second network component 12 First receive encrypted data (S11).

Subsequently, will in the received encrypted Data automatically a key information identified (S12). In the present case, the key information the key identifier designating the coding key K3 used, which the encrypted Added data in step (S9) has been. Consequently, the key information simply be read from the received encrypted data.

If the key information identified known coding key K3, the received encrypted data is automatically under Use of this coding key K3 decrypts (S13).

If such key information is not contained or unidentifiable in the received encrypted data, the method according to an alternative embodiment may further comprise the steps of identifying one for addressing a respective transmitting (fourth) communication interface 34 communication address used in a protocol data part detected using specifications of transmission protocols and searching for a key identifier associated with that communication address. If a key identifier is assigned to this communication address, the coding key K3 assigned to this key identifier is used in the subsequent decryption of the data.

Further alternatively you can also all known coding keys be tried.

Subsequently, will checked in step (S14) whether the encrypted Data actually by means of the coding key K3 decrypts could become.

If this is not the case, then a transmission of the over the transmission network 20 received data to the second communication interface automatically prevented (S19).

Otherwise, will automatically be a checksum the decrypted Calculates data (S16) and decrypts the received ones Data added Control value identified (S15).

in the following step (S17), the correspondence of the calculated checksum checked with the control value identified in the received data.

If the match is given, the decrypted data is automatically sent to the associated second communication interface 34 forwarded (S18) and so becomes a data connection between the fourth and the second communication interface 14 . 12 provided.

there the forwarding of the decrypted data includes an automatic Create a new log data part for the decrypted Payload part using the specification of the identified transmission protocol and a detected log data part of the to be decrypted Data as well as forming from the identified transmission protocol decrypted Data from the new log data part and the decrypted one Payload. This will be done in the formation of the new protocol data part for the decrypted Payload part, the detected communication address preferably maintained.

Otherwise, a transmission will take place over the transmission network 20 received data to the second communication interface 32 automatically prevented (S19).

In the example, the above process steps (S11) - (S19) by the second Network component 12 executed.

It it is emphasized that of the above described order of Steps can be deviated suitably. Also, there are some steps such as the use of the control value and the identification the transmission protocol or the key information only optional.

Also if the control value above for the to be encrypted Data can be calculated and added to the still unencrypted data the control value as an alternative to the steps (S6), (S7) also for the encrypted Data is calculated and added to the encrypted data. Accordingly, the identification of the control value and the calculation of the checksum between the steps (S8) and (S10) using the still encrypted ones Data is done.

Furthermore, it may be advantageous if the method according to the invention in step (S11) of receiving, for example, from the eighth or ninth communication interface 38 . 39 over the transmission network 20 sent unencrypted data through the second network component 12 the steps of automatically detecting that the received data is not encrypted by a predetermined encryption key K1, K3 and preventing transmission of the received unencrypted data to the at least one associated second communication interface 32 through the second network component 12 includes.

Around the for the implementation the method according to the invention To keep required effort low, it can be further advantageous be if in steps (S8) and (S13) decrypting or encode of only the payload part by means of the at least one coding key K1, K3 takes place.

In the above-described example of the preferred embodiment of the method according to the invention, it has been assumed that in steps (S2) - (S5) one for addressing a respective addressed (second) communication interface 32 used communication address is assigned a key identifier, and based on this key identifier a suitable coding key K3 for the encryption of the data can be determined.

To also have a data connection to the second communication interface 32 In accordance with a first approach, the method further comprises the steps of encrypting predetermined test data using any given encoding key K3 and sending the encrypted test data to the addressed second communication interface 32 on.

The transmission protocols of many transmission networks 20 provide that communication interfaces 31 - 39 the reception of data automatically by a via the transmission network to the respective transmitting communication interface 31 - 39 acknowledge the received acknowledgment. If this is not the case with a transmission protocol used, this can also be initiated automatically by correspondingly predetermined test data.

If such an acknowledgment is received as a result of sending the encrypted test data, it is clear that one of the receiving (second) communication interface 32 associated (second) network component 12 has the coding key K3 used for encryption. This coding key K3 can thus be used to provide a data connection.

A second approach to providing a data connection when addressing the respective addressed communication interface 31 - 37 used communication address is assigned no key identifier is described below. In a modification of the previous example is intended between the in 1 shown first and sixth and seventh communication interfaces 31 such as 36 and 37 a data connection is provided.

In this case, creates the first network component 11 the first communication interface 31 automatically unencrypted payloads that specify key identifiers that correspond to the first network component 11 denote known coding keys K1 and K3. This unencrypted payload is provided by the first network component 11 indicating an associated first communication interface 31 as the sender identifying communication address via the transmission network 20 to the sixth and seventh communication interface 36 and 37 transmitted.

The front of the sixth and seventh communication interface 36 and 37 arranged sixth network component 16 receives the unencrypted user data.

The sixth network component 16 automatically detects that over the transmission network 20 received unencrypted payloads that specify multiple key identifiers and compares the specified multiple keykits tions of the coding keys K1, K3 with the key identifier corresponding to that of the sixth network component 16 Known pre given coding K1 called. Subsequently, the sixth network component identifies 16 in a protocol data part to the received unencrypted user data automatically to address the sending first communication interface 31 used communication address and creates unencrypted user data indicating the common key identifier of the common coding key K1. This unencrypted payload is provided by the sixth network component 16 indicating communication addresses representing the associated sixth and seventh communication interfaces 36 and 37 identify as the sender, via the transmission network 20 to the first communication interface 31 transfer.

The front of the first communication interface 31 arranged first network component 11 receives the unencrypted payload data and automatically detects that unencrypted payload data has been received indicating common key identifiers. As a result, the first network component identifies 11 automatically to address the sending sixth and seventh communication interface 36 and 37 used communication addresses in the received protocol data part of the received unencrypted user data and assigns the identified communication addresses, the common key identifier of the common coding key K1. Due to this assignment, it is possible to choose between the first and the sixth as well as the seventh communication interface 31 . 36 . 37 a data connection is provided.

In the preferred embodiment described above, it has been assumed that data transmission in the transmission network 20 via a channel by means of data, which consist of a protocol data part and a user data part. However, the inventive method is also applicable to transmission networks in which a data transmission of a protocol data part and a Nutzdatenteils separated and in particular (but not exclusively) via different channels of the transmission network.

In In this case, the inventive method preferably has the Steps of Receiving an Unencrypted Log Data Part Via the First Channel, which protocol data part one in the respective transmission network used for addressing a respective communication interface Communication address indicates and receiving an encrypted or unencrypted Nutzdatenteils about the second channel, which payload part between the communication interfaces to be transferred Contains data, on.

Corresponding can specifically in the protocol data part received a communication address a sending and / or receiving communication interface be identified and in the method described above be used. Accordingly, only the over the second channel received Nutzdatenteil using the at least a given coding key decrypts or encrypted.

Around the safety of the method according to the invention In addition, to further increase the availability of a data connection Steps to determine the identity of a user and the comparison the established identity with the identities allowed User be provided. In this case, the steps of the decryption or encryption by means of the at least one predetermined coding key K1, K2, K3 only executed when the established identity associated with a permitted user. That way that can inventive method Make sure the data connections are only one given Be provided.

The method according to the invention described above can be advantageously carried out by means of the above-described network component according to the invention 11 in the communication network according to the invention described above 1 be executed.

In summary enable the network component according to the invention, the communication network according to the invention and the method according to the invention to provide a data connection on particularly simple and reliable Way without user intervention a secure data exchange between at least two over a transmission network interconnected communication interfaces. It will access by an unauthorized person to one with the transmission network Connected communication interface via the transmission network at the same time considerably more difficult.

Claims (68)

Network component ( 11 . 12 . 13 . 14 . 15 . 16 ) for a communications network ( 1 ), in which a plurality of communication interfaces ( 31 . 32 . 33 . 34 . 35 . 36 . 37 ) for mutual exchange of data via a transmission network ( 20 ), the network component ( 11 . 12 . 13 . 14 . 15 . 16 ) between at least one associated Kom communication interface ( 31 - 37 ) and the transmission network ( 20 ), characterized in that the network component ( 11 - 16 ) comprises: a first memory device ( 41 ) for storing at least one predetermined coding key (K1, K2, K3), a decryptor ( 51 ) for decrypting over the transmission network ( 20 ) received encrypted data using the stored at least one coding key (K1, K2, K3), and a data selector ( 52 ) for selectively transferring data between the transmission network ( 20 ) and the at least one associated communication interface ( 31 - 37 ), where the data selector ( 52 ), a transmission from over the transmission network ( 20 ) received encrypted data to the at least one associated communication interface ( 31 - 37 ) automatically if the encrypted data is encrypted by the decryptor ( 51 ) can not be decrypted by means of the at least one coding key (K1, K2, K3). The network component ( 11 - 16 ) according to claim 1, wherein the data selector ( 52 ) is formed, via the transmission network ( 20 ) received encrypted data after decryption by the decryptor ( 51 ) by means of the at least one coding key (K1, K2, K3) automatically to the at least one associated communication interface ( 31 - 37 ) forward. The network component ( 11 - 16 ) according to claim 1 or 2, wherein the network component ( 11 - 16 ) a first interface ( 61 ) for connecting the network component ( 11 - 16 ) with the at least one associated communication interface ( 31 - 37 ) and a second interface ( 62 ) for connecting the network component ( 11 - 16 ) with the transmission network ( 20 ), the first interface ( 61 ) with the data selector ( 52 ) and the second interface ( 62 ) with the decryptor ( 51 ) connected is. The network component ( 11 - 16 ) according to one of claims 1 to 3, wherein the decryptor ( 51 ) is further adapted to communicate over the transmission network ( 20 ) encrypted data automatically identify a key information identifying a coding key used for the encryption (K1, K2, K3). The network component ( 11 - 16 ) according to claim 4, wherein the key information is a key identifier which is transmitted over the transmission network ( 20 ) received encrypted data is unencrypted. The network component ( 11 - 16 ) according to claim 4 or 5, wherein the communication interfaces ( 31 - 37 ) of the transmission network for addressing in the context of the mutual data exchange in each case a communication address is assigned, and wherein the key information from that for addressing a respective communication interfaces ( 31 - 37 ) communication address is different. The network component ( 11 - 16 ) according to one of claims 1 to 6, wherein the network component ( 11 - 16 ) further comprises: an encryptor ( 53 ) for encrypting from the associated communication interface ( 31 - 37 received data using the stored at least one coding key (K1, K2, K3), wherein the data selector ( 52 ) is formed by the associated communication interface ( 31 - 37 ) received data after encryption by the encryptor ( 53 ) by means of the at least one coding key (K1, K2, K3) automatically to the transmission network ( 20 ). The network component ( 11 - 16 ) according to claim 7, wherein in the first memory device ( 41 ) to which at least one predetermined coding key (K1, K2, K3) a key identifier indicating the coding key (K1, K2, K3) is stored, and wherein the encryptor ( 53 ) is formed, the encrypted by means of at least one coding key (K1, K2, K3) encrypted data after encryption automatically the respective key identifier of the coding key used (K1, K2, K3) unencrypted. The network component ( 11 - 16 ) according to one of claims 7 or 8, wherein the encryptor ( 53 ) is designed to automatically generate a control value for the communication interface (C) before encryption. 31 - 37 ) to be encrypted data or already encrypted data and to add the calculated control value before the encryption of the data to be encrypted or after encryption the encrypted data. The network component ( 11 - 16 ) according to one of claims 1 to 9, wherein the decryptor ( 51 ) is adapted to automatically identify a control value in the encrypted data or the decrypted data, to calculate a checksum for the data decrypted by the at least one coding key (K1, K2, K3) or the encrypted data and to compare the checksum with the control value , and wherein the data selector ( 52 ) is formed, a Transmission of decrypted data to the at least one associated communication interface ( 31 - 37 ) automatically if the checksum does not match the control value. The network component ( 11 - 16 ) according to one of claims 1 to 10, wherein the data selector ( 52 ), a transmission from over the transmission network ( 20 received unencrypted data to the at least one associated communication interface ( 31 - 37 ) automatically. The network component ( 11 - 16 ) according to one of claims 1 to 11, wherein the network component ( 11 - 16 ) one into the network component ( 11 - 16 ) permanently integrated second memory device ( 42 ), in which at least one specification of one in the communication network ( 1 ) is stored, and wherein the decryptor ( 51 ) is formed into the transmission network ( 20 ) using the stored specifications to detect an unencrypted protocol data part attributable only to the respective transmission protocol used and an encrypted user data part containing the remaining data and to decrypt only the encrypted user data part by means of the at least one coding key (K1, K2, K3). The network component ( 11 - 16 ) according to claim 12, wherein the decryptor ( 51 ) is adapted to automatically create a new log data part for the decrypted payload part using the stored specifications and the detected log data part. The network component ( 11 - 16 ) according to claim 13, wherein the decryptor ( 51 ) is formed in the detected protocol data part automatically one in the transmission network ( 20 ) for addressing a respective addressed communication interface ( 31 - 37 ) and identify the new protocol data part for the decrypted payload part while maintaining the detected communication address. The network component ( 11 - 16 ) according to one of claims 1 to 11, wherein the decryptor ( 51 ) is configured to receive an unencrypted protocol data part via a first channel of the transmission network, which protocol data part contains a signal in the respective transmission network ( 20 ) for addressing a respective communication interface ( 31 - 37 ) indicates, via a second, different from the first channel of the transmission network channel of the transmission network to receive an encrypted user data part, which Nutzdatenteil between the communication interfaces ( 31 - 37 ) contains data to be transmitted, and to decrypt only the encrypted user data part by means of the at least one coding key (K1, K2, K3). The network component ( 11 - 16 ) according to one of claims 12 to 15, wherein the decryptor ( 51 ) is formed, in the detected or received via the first channel protocol data part automatically in the transmission network ( 20 ) for addressing a respective transmitting communication interface ( 31 - 37 ) and identify, together with a key identifier, the coding key (K1, K2, K3) used for the decryption in the first and / or second memory device ( 42 ) save. The network component ( 11 - 16 ) according to claim 16, wherein the decryptor ( 51 ) is formed in the detected or received via the first channel protocol data part automatically for addressing a respective transmitting communication interface ( 31 - 37 ) to identify the communication address used in the first and / or second memory device ( 42 ) to search for a key identifier assigned to this communication address or to identify key information in the user data part and to use the coding key (K1, K2, K3) associated with the respective key identifier or key information in the decryption of the encrypted user data part. The network component ( 11 - 16 ) according to claim 16, wherein the encryptor ( 53 ) is formed in the detected or received via the first channel protocol data part automatically for addressing a respective addressed communication interface ( 31 - 37 ) to identify the communication address used in the first and / or second memory device ( 42 ) to search for a key identifier associated with this communication address and to use the coding key (K1, K2, K3) assigned to the respective key identifier in the encryption of the data. The network component ( 11 - 16 ) according to claim 18, wherein the encryptor ( 53 ) is configured to generate automatically predetermined test data using any one of the first and / or second memory devices ( 41 . 42 ) encoded predetermined Kodierschlüssels (K1, K2, K3) and over the transmission network ( 20 ) to a respective addressed communication interface ( 31 - 37 ) when in the first and / or second memory device ( 41 . 42 ) none of the addresses addressed for addressing the respective addressed communication interface ( 31 - 37 ) used communication identifier associated key identifier is stored. The network component ( 11 - 16 ) according to claim 18, wherein the encryptor ( 53 ) is formed, automatically unencrypted user data, all in the first and / or second memory device ( 41 . 42 ) of the network component ( 11 - 16 specified key identifiers or a subset thereof, via the transmission network ( 20 ) to a respective addressed communication interface ( 31 - 37 ) when in the first and / or second memory device ( 41 . 42 ) none of the addresses addressed for addressing the respective addressed communication interface ( 31 - 37 ) used communication identifier associated key identifier is stored. The network component ( 11 - 16 ) according to claim 20, wherein the decryptor ( 51 ) in order to receive unencrypted payload data via the transmission network ( 20 ), which specify several key identifiers, automatically assign the specified key identifiers to all in the first and / or second memory device ( 41 . 42 ) of the network component ( 11 - 16 ), in the protocol data part associated with the received user data or received via the first channel for addressing a respective transmitting communication interface ( 31 - 37 ) to identify the communication address used, and via the transmission network ( 20 ) to the respective sending communication interface ( 31 - 37 ) to send unencrypted payloads containing all common key identifiers. The network component ( 11 - 16 ) according to claim 21, wherein the decryptor ( 51 ) is formed upon receipt of unencrypted payload data via the transmission network ( 20 ) which specify common key identifiers, automatically in the protocol data part which is associated with the received user data or received via the first channel and which is used for addressing a respective transmitting communication interface ( 31 - 37 ), and together with the common key identifiers in the first and / or second memory device ( 41 . 42 ) save. The network component ( 11 - 16 ) according to one of claims 12 to 14, wherein the encryptor ( 53 ) is formed, in which of the at least one associated communication interface ( 31 - 37 Received data using the stored specifications automatically ei NEN only to the respective used transmission protocol log data part to be detected and the remaining data containing Nutzdatenteil to detect and to encrypt only the Nutzdatenteil means of at least one coding key (K1, K2, K3). The network component ( 11 - 16 ) according to claim 23, wherein the encryptor ( 53 ) is adapted to automatically create a new protocol data part for the encrypted user data part using the stored specifications and the detected protocol data part. The network component ( 11 - 16 ) according to claim 24, wherein the encryptor ( 53 ) is formed in the detected protocol data part automatically one in the transmission network ( 20 ) for addressing a respective addressed communication interface ( 31 - 37 ) and to form the new protocol data part for the encrypted user data part while maintaining the detected communication address. The network component ( 11 - 16 ) according to one of claims 1 to 25, wherein the first memory device ( 41 ) and / or the second memory device ( 42 ) into the network component ( 11 - 16 ) permanently integrated non-volatile memory. The network component ( 11 - 16 ) according to one of claims 1 to 26, wherein the network component ( 11 - 16 ) a management device ( 54 ), which is configured to configure settings on the network component ( 11 - 16 ). The network component ( 11 - 16 ) according to claim 27, wherein the management device ( 54 ) one via the transmission network ( 20 ) addressable communication address is assigned and the management device ( 54 ) for the exchange of management data with the transmission network ( 20 ). The network component ( 11 - 16 ) according to one of claims 26 to 28, wherein the network component ( 11 - 16 ) a first identification system ( 71 ) for determining the identity of a user, and wherein the first identification system ( 71 ) allows reading of the memory and / or an activity of the management system only after successful identification of a user. The network component ( 11 - 16 ) according to one of claims 1 to 29, wherein the first memory device ( 41 ) is a removable nonvolatile storage medium, the network component ( 11 - 16 ) a memory interface ( 43 ) for the removable storage medium, and the second storage device ( 42 ) into the network component ( 11 - 16 ) permanently integrated non-volatile memory. The network component ( 11 - 16 ) according to claim 30, wherein the removable storage medium is a floppy disk, a compact disc, a digital versatile disc, a smart card or a USB token. The network component ( 11 - 16 ) according to claim 30 or 31, wherein the removable storage medium comprises a second identification system ( 72 ) for determining the identity of a user, and wherein the second identification system ( 72 ) allows reading of the removable storage medium only after successful identification of a user. The network component ( 11 - 16 ) according to one of claims 30 to 32, wherein the removable storage medium is assigned an individual storage medium identifier and wherein the encryptor ( 53 ) is formed, the storage medium identifier of a via the memory interface ( 43 ) for the removable storage medium with the network component ( 11 - 16 ) readable removable storage medium and add the read storage medium identifier to the encrypted data or the encrypted data. The network component ( 11 - 16 ) according to claim 29 or 32, wherein the first and / or second identification system ( 71 . 72 ) has a keyboard for entering a personal identification code and / or a sensor for detecting biometric data. The network component ( 11 - 16 ) according to one of claims 7 to 34, wherein the network component ( 11 - 16 ) is assigned an individual network component identifier, and wherein the encryptor ( 53 ) is adapted to automatically read the network component identifier and the data to be encrypted, the network component identifier of the network component ( 11 - 16 ). The network component ( 11 - 16 ) according to one of claims 1 to 35, wherein in the first memory device ( 41 ) are each associated with metadata and the metadata contain information about the manner of using the respective coding key (K1, K2, K3) and / or in the second memory device ( 42 ) Metadata are stored, each associated with a key identifier of a coding key (K1, K2, K3). The network component ( 11 - 16 ) according to one of claims 1 to 36, wherein the decryptor ( 51 ), the encryptor ( 53 ), the data selector ( 52 ) and preferably the management device ( 54 ) are integrated in a microprocessor. The network component ( 11 - 16 ) according to claim 37, wherein the microprocessor comprises an operating system which is provided by an operating system of the at least one associated communication interface ( 31 - 37 ) is different. Communication network ( 1 ) comprising a data exchange enabling transmission network ( 20 ) and a plurality of the transmission network ( 20 ) communication interfaces ( 31 . 32 . 33 . 34 . 35 . 36 . 37 ), the communication interfaces ( 31 - 37 ) for data exchange over the transmission network ( 20 ), the communication network ( 1 ) at least two network components ( 11 . 12 . 13 . 14 . 15 . 16 ) having the features of one of claims 1 to 38 and the network components ( 11 - 16 ) at least one communication interface ( 31 - 37 ), as well as between the respective assigned communication interface ( 31 - 37 ) and the transmission network ( 20 ) are arranged. The communication network ( 1 ) according to claim 39, wherein at least one of the at least two network components ( 11 - 16 ) between a plurality of this network component ( 11 - 16 ) associated communication interfaces ( 31 - 37 ) and the transmission network ( 20 ) is arranged. The communication network ( 1 ) according to claim 39 or 40, wherein the communication interfaces ( 31 - 37 ) of the communication network for addressing each other in the context of the mutual data exchange is assigned a unique communication address, and wherein the network components ( 11 - 16 ) are formed so that the respective communication address of the associated communication interface ( 31 - 37 ) for the transmission network ( 20 ) is visible. The communication network ( 1 ) according to claim 39, 40 or 41, wherein the communication interfaces ( 31 - 37 ) are designed to transfer data prior to output to the respective associated network component ( 11 - 16 ) according to one of the transmission network ( 20 ) and to encode the network components ( 11 - 16 ) formed by the respective associated communication interface ( 31 - 37 ) to process the received data in such a way that also the processed data corresponding to that of the transmission network ( 20 ) are coded. The communication network ( 1 ) according to any one of claims 39 to 42, wherein each communication interface ( 31 - 37 ) is assigned a communication address, and wherein the transmission network ( 20 ) Switches and / or routers, which on the basis of the communication address specific transmission paths between the communication interfaces ( 31 - 37 ) provide. The communication network ( 1 ) according to one of claims 39 to 43, wherein the transmission network ( 20 ) between the communication interfaces ( 31 - 37 ) provides an IEEE802.3 Ethernet connection or an IEEE802.11 wireless LAN connection or an ISDN connection or a GSM connection or a UMTS connection or a TCP / IP connection. The communication network ( 1 ) according to one of claims 39 to 44, wherein the network component ( 11 - 16 ) one of the respective assigned communication interface ( 31 - 37 ) is separate device. Method for providing a data connection between at least two via a transmission network ( 20 ) interconnectable communication interfaces ( 31 . 32 . 33 . 34 . 35 . 36 . 37 ), wherein between at least two of the communication interfaces ( 31 - 37 ) and the transmission network ( 20 ) each have a network component ( 11 . 12 . 13 . 14 . 15 . 16 ), comprising the following steps: - (S11) receiving from a communication interface ( 31 - 37 ) via the transmission network ( 20 ) encrypted data sent by the respective network component ( 11 - 16 ) before outputting the data to the respective communication interface ( 31 - 37 ); - (S13) decrypting the received encrypted data using at least one predetermined coding key (K1, K2, K3); and - (S18) forwarding the decrypted data by the network component ( 11 - 16 ) to the respective communication interface ( 31 - 37 ) for providing a data connection, if the encrypted data can be decrypted by means of the at least one coding key (K1, K2, K3). The method of claim 46, further comprising the steps of: - (S12) identifying one of the ones in the over the transmission network ( 20 ) received encrypted data containing key information indicative of an encryption key used for encryption (K1, K2, K3); and - using the one of the predetermined coding keys (K1, K2, K3) corresponding to the identified key information to decrypt the data. The method of claim 46 or 47, further comprising the steps of: - encrypting (S8) a communication interface (S8); 31 - 37 ) via the transmission network ( 20 ) data to be transmitted before an output of the data to the transmission network ( 20 ) by the network component using the at least one predetermined encoding key (K1, K2, K3); and - (S10) output of the encrypted data to the transmission network ( 20 ). The method of claim 48, further comprising the step of: - (S9) adding a key identifier indicative of the encryption key used in the encryption (K1, K2, K3) to the encrypted data before outputting the encrypted data to the transmission network ( 20 ). The method of claim 48 or 49, further having the following steps: - (S2) calculating a control value for the to be encrypted Data or the encrypted Dates; and - (S3) Add the control value to the data to be encrypted before encryption or to the encrypted Data after encryption. The method of any one of claims 46 to 50, further comprising the steps of: - (S15) identifying a control value in the encrypted data or the decrypted data; - (S16) calculating a checksum for the data decrypted by the at least one coding key (K1, K2, K3) or the encrypted data; - (S17) comparing the checksum with the control value; and - (S19) preventing transmission of the decrypted data to the at least one associated communication interface ( 31 - 37 ) if the checksum does not match the control value. The method of any one of claims 46 to 50, further comprising the steps of: - receiving from a communication interface ( 31 - 37 ) via the transmission network ( 20 ) sent unencrypted data by the respective network component ( 11 - 16 ); - recognizing that the received data is not encrypted by means of a given coding key (K1, K2, K3); and preventing transmission of the received unencrypted data to the at least one associated communication interface ( 31 - 37 ) by the network component ( 11 - 16 ). The method of any one of claims 46 to 52, further comprising the steps of: - identifying one in the transmission network ( 20 ) using the transmission network ( 20 ) received encrypted data using specifications of known transmission protocols; - detecting an unencrypted protocol data part attributable solely to the particular transmission protocol used and an encrypted user data part containing the remaining data in the received encrypted data; and decrypting only the encrypted user data part by means of the at least one coding key (K1, K2, K3). The method according to claim 53, further comprising following steps: - Create a new log data part for the decrypted Payload part using the specification of the identified transmission protocol and the detected protocol data part; and - Form from the identified transmission protocol corresponding decrypted Data from the new log data part and the decrypted payload part. The method of claim 54, further comprising the steps of: - identifying one in the transmission network ( 20 ) for addressing a respective addressed communication interface ( 31 - 37 ) used communication address in the detected protocol data part; and - forming the new protocol data part for the decrypted user data part while maintaining the detected communication address. The method according to one of claims 46 to 52, further comprising the following steps: receiving an unencrypted protocol data part via a first channel of the transmission network, which protocol data part contains a signal in the respective transmission network ( 20 ) for addressing a respective communication interface ( 31 - 37 ) indicates the communication address used; Receiving an encrypted user data part via a second channel, different from the first channel of the transmission network, of the transmission network, which user data part lies between the communication interfaces ( 31 - 37 ) contains data to be transmitted; wherein only the payload data portion received via the second channel is decrypted using the at least one predetermined encryption key (K1, K2, K3). The method of any of claims 53 to 56, further comprising the steps of: - identifying one in the transmission network ( 20 ) for addressing a respective transmitting communication interface ( 31 - 37 ) used communication address in the detected or received over the first channel protocol data part; and - assigning the identified communication address to a key identifier designating the encryption key (K1, K2, K3) used for the decryption after decrypting the received payload part. The method of claim 57, further comprising the steps of: - identifying one for addressing a respective sending communication interface ( 31 - 37 ) used communication address in the detected or received over the first channel protocol data part of the data to be decrypted; Identifying from one to the other via the transmission network ( 20 ) received encrypted data containing key information identifying a coding key used for the encryption (K1, K2, K3) or searching a key identifier associated with this communication address; and - using the coding key (K1, K2, K3) associated with the respective key identifier in the decryption of the data. The method of any one of claims 53 to 55, further comprising the steps of: - (S4) identifying one in the transmission network ( 20 ) used by the at least one associated communication interface ( 31 - 37 received unencrypted data using specifications of known transmission protocols; - (S5) detecting a protocol data part attributable solely to the respective transmission protocol used and one of the remaining data containing user data part in the received data; and - encrypting only the payload part by means of the at least one coding key (K1, K2, K3). The method according to claim 59, further comprising following steps: - Create a new log data part for the encrypted Payload part using the specification of the identified transmission protocol and the detected protocol data part; and - Form from the identified transmission protocol corresponding encrypted Data from the new log data part and the encrypted payload part. The method of claim 60, further comprising the steps of: - identifying one in the transmission network ( 20 ) for addressing a respective addressed communication interface ( 31 - 37 ) used communication address in the detected protocol data part; and - forming the new protocol data part for the encrypted user data part while maintaining the detected communication address. The method according to claim 57 or 58, further comprising the following steps: - (S6) identifying one for addressing a respective addressed communication interface ( 31 - 37 ) used communication address in the detected or received over the first channel protocol data part; - (S7) searching for a key identifier associated with this communication address; and - using the encryption key associated with the respective key identifier (K1, K2, K3). The method of claim 62, further comprising the steps of: - encrypting predetermined test data using any given encoding key (K1, K2, K3); and - sending the encrypted test data to a respective addressed communication interface ( 31 - 37 ); if the address used for addressing the respective addressed communication interface ( 31 - 37 ) used communication address is assigned no key identifier. The method of claim 62, further comprising the steps of: - generating unencrypted payload data indicating key identifiers indicating all or a subset of the predetermined encode keys (K1, K2, K3); and - sending the unencrypted user data to a respective addressed communication interface ( 31 - 37 ); if the address used for addressing the respective addressed communication interface ( 31 - 37 ) used communication address is assigned no key identifier. The method of claim 64, further comprising the steps of: - determining that via the transmission network ( 20 received unencrypted payload data indicating multiple key identifiers; Comparing the plurality of key identifiers indicated in the received unencrypted user data with the key identifiers designating the given encryption keys (K1, K2, K3); Identifying one for addressing a respective transmitting communication interface ( 31 - 37 ) used communication address in the detected or received over the first channel protocol data part to the received unencrypted user data; - Create unencrypted payloads that specify all common key identifiers; and - sending the unencrypted user data to a respective transmitting communication interface ( 31 - 37 ). The method of claim 65, further comprising the steps of: - determining that via the transmission network ( 20 received unencrypted payload data indicating shared key identifiers; Identifying one for addressing a respective transmitting communication interface ( 31 - 37 ) used communication address in the detected or received over the first channel protocol data part to the received unencrypted user data; and - associating the identified communication address with the common key identifiers. The method of any of claims 46 to 65, further comprising the following steps: - finding the identity a user; - Comparison the established identity with the identities allowed user; and - Perform a decryption or encryption by means of the at least one predetermined coding key (K1, K2, K3) only if the identified identity is a permitted user assigned. The method of any of claims 46 to 67, wherein the described method steps by means of a network component according to one of the claims 1 to 38 executed become.